Iswangxy

**Name of the Vulnerable Software and Affected Versions** yaojingang GEOFlow versions prior to 2.1.1 **Description** A remote cross site scripting issue exists within the JSON-LD Theme Handler component, specifically in the file app/Http/Controllers/Site/HomeController.php. The flaw allows for remote exploitation through the manipulation of the `Search` argument. **Recommendations** Update to version 2.1.1.

**Name of the Vulnerable Software and Affected Versions** yaojingang GEOFlow versions prior to 2.1.1 **Description** A path traversal issue exists in the Image Library Cleanup component within the `unlink()` function of the `app/Http/Controllers/Admin/ImageLibraryController.php` file. A remote attacker can manipulate the `file path` argument to access or delete files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Upgrade to version 2.1.1.

**Name of the Vulnerable Software and Affected Versions** yaojingang GEOFlow versions prior to 2.1.1 **Description** A code injection flaw exists in the Superadmin Theme Editor component within the `preview()` function of the `app/Http/Controllers/Admin/SiteThemeEditorController.php` file. A remote attacker can trigger this issue by manipulating the `blade` argument. **Recommendations** Update to version 2.1.1. As a temporary mitigation, restrict access to the `preview()` function in the Superadmin Theme Editor component.

**Name of the Vulnerable Software and Affected Versions** yaojingang GEOFlow versions prior to 2.1.1 **Description** A server-side request forgery (SSRF) issue exists that allows remote attackers to manipulate the `endpoint url` argument. This occurs within the `isValidHttpEndpoint()` function located in the app/Services/GeoFlow/GenericHttpEndpointResolver.php file. **Recommendations** Update to version 2.1.1. As a temporary mitigation, restrict access to the `isValidHttpEndpoint()` function.

**Name of the Vulnerable Software and Affected Versions** klaussilveira GitList version 2.0.0 **Description** An OS command injection flaw exists in the Git Command Line component. The issue resides within the `getDefaultBranch()` function located in the `src/SCM/System/Git/CommandLine.php` file, which allows a remote attacker to execute arbitrary operating system commands. **Recommendations** Upgrade to version 3.0.0-beta. As a temporary mitigation, restrict access to the `getDefaultBranch()` function.

**Name of the Vulnerable Software and Affected Versions** klaussilveira GitList version 2.0.0 **Description** A remote denial of service can be triggered through the XML Parsing component. The issue resides in the `SimpleXMLElement()` function within the `src/SCM/System/Git/CommandLine.php` file. **Recommendations** Upgrade to version 3.0.0-beta. As a temporary mitigation, restrict access to the `SimpleXMLElement()` function in the `src/SCM/System/Git/CommandLine.php` file.